# CVE-2026-5193: WPDeveloper Essential Addons for Elementor privilege escalation

Source: https://junglewise.ai/threats/cve-2026-5193-wpdeveloper-essential-addons-for-elementor-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-5193 · Severity: medium · CVSS 6.5 · Published 2026-05-14

A popular WordPress plugin used to add custom design elements to websites contains a security flaw that allows certain users to gain higher permissions. Specifically, users with 'author' level access can create new accounts with 'editor' privileges, bypassing intended security restrictions. This could allow a lower-level staff member or contributor to gain unauthorized control over website content and management.

Technologies: [WPDeveloper Essential Addons for Elementor](https://junglewise.ai/threats/technologies/essential-addons-for-elementor). Vendors: [WPDeveloper](https://junglewise.ai/threats/vendors/wpdeveloper).

## Quick answers

**Is CVE-2026-5193 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5193 being exploited in the wild.

**How severe is CVE-2026-5193?** Medium severity, with a CVSS score of 6.5, published 14 May 2026.

**Which products and versions are affected?** WPDeveloper Essential Addons for Elementor Up to, and including, 6.5.13.

**Is there a fix for CVE-2026-5193?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5193 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5193?** Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists within the 'register_user' function of the Essential Addons for Elementor plugin. The root cause is improper privilege management (CWE-269) where the function's role validation logic only explicitly blocks the 'administrator' role, failing to restrict other high-privilege roles. An authenticated attacker with Author-level permissions or higher can exploit this over the network to register new users with the 'Editor' role. This flaw affects all versions up to and including 6.5.13. A patch has been identified in the plugin's development changeset.

## Affected products

- WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets Up to, and including, 6.5.13

## Timeline

- 2026-05-14: advisory: NVD and Wordfence published the vulnerability details.
- 2026-05-14: disclosed

## References

- [https://plugins.trac.wordpress.org/changeset/3499726/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php](https://plugins.trac.wordpress.org/changeset/3499726/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/22930940-8e2c-446a-954c-90d617f3ca6d?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/22930940-8e2c-446a-954c-90d617f3ca6d?source=cve)

## Related threats

- [WPDeveloper Essential Addons for Elementor privilege escalation](https://junglewise.ai/threats/cve-2026-110898-incorrect-privilege-assignment-vulnerability-in-wpdeveloper)
- [WPDeveloper Essential Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-102394-improper-neutralization-of-input-during-web-page-generation)
- [WPDeveloper Essential Addons for Elementor authentication bypass](https://junglewise.ai/threats/cve-2026-81777-wpdeveloper-essential-addons-for-elementor-authentication-bypass)
- [Essential Addons for Elementor information disclosure in product-comparison feature](https://junglewise.ai/threats/cve-2026-13345-essential-addons-for-elementor-information-disclosure-in-product)
- [WPDeveloper Essential Addons for Elementor Stored XSS in Fancy Text Widget](https://junglewise.ai/threats/cve-2026-15145-wpdeveloper-essential-addons-for-elementor-stored-xss-in-fancy)